Sereal::Decoder versions from 4.000 through 4.009_002 for Perl is vulnerable to a buffer overwrite flaw in the Zstandard library.

Sereal::Decoder embeds a vers…

Sereal::Decoder versions 4.000 through 4.009_002 for Perl contains a buffer overwrite vulnerability in an embedded Zstandard library component. The vulnerability stems from CVE-2019-11922, a race condition in Zstandard's one-pass compression functions prior to version 1.3.8. Attackers can exploit this flaw to write bytes out of bounds when an output buffer smaller than the recommended size is used. The vulnerability affects the popular Perl serialization library and could lead to memory corruption attacks.